Hi all,

I am playing with limiting client access to certain subdirectories of cephfs running latest 12.2.4 and latest centos 7.4 kernel, both using kernel client and fuse


I am following http://docs.ceph.com/docs/luminous/cephfs/client-auth/:

/To completely restrict the client to the //|bar|//directory, omit the root directory/

//

///ceph////fs////authorize////cephfs////client//.//foo///////bar////rw///

When I mount this directory with fuse, this works. When I try to mount the subdirectory directly with the kernel client, I get

/mount error 13 = Permission denied /

This only seems to work when the root is readable.

--> Is there a way to mount subdirectory with kernel client when parent in cephfs is not readable ?


Then I checked the data pool with rados, but I can list/get/.. every object in the data pool using the client.foo key.

I saw in the docs of master http://docs.ceph.com/docs/master/cephfs/client-auth/ that you can add a tag cephfs, but if I add this I can't write anything to cephfs anymore, so I guess this is not yet supported in luminous.

--> Is there a way to limit the cephfs user to his data only (through cephfs) instead of being able to do everything on the pool, without needing a pool for every single cephfs client?



Thanks!!

Kenneth
_______________________________________________
ceph-users mailing list
ceph-users@lists.ceph.com
http://lists.ceph.com/listinfo.cgi/ceph-users-ceph.com

Reply via email to